src/libcharon/sa/child_sa.c

   1 /*
   2  * Coypright (C) 2016 Andreas Steffen
   3  * Copyright (C) 2006-2016 Tobias Brunner
   4  * Copyright (C) 2005-2008 Martin Willi
   5  * Copyright (C) 2006 Daniel Roethlisberger
   6  * Copyright (C) 2005 Jan Hutter
   7  * HSR Hochschule fuer Technik Rapperswil
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by the
  11  * Free Software Foundation; either version 2 of the License, or (at your
  12  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  16  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  17  * for more details.
  18  */
  19
  20 #define _GNU_SOURCE
  21 #include "child_sa.h"
  22
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <time.h>
  26
  27 #include <daemon.h>
  28 #include <collections/array.h>
  29
  30 ENUM(child_sa_state_names, CHILD_CREATED, CHILD_DESTROYING,
  31         "CREATED",
  32         "ROUTED",
  33         "INSTALLING",
  34         "INSTALLED",
  35         "UPDATING",
  36         "REKEYING",
  37         "REKEYED",
  38         "RETRYING",
  39         "DELETING",
  40         "DESTROYING",
  41 );
  42
  43 typedef struct private_child_sa_t private_child_sa_t;
  44
  45 /**
  46  * Private data of a child_sa_t object.
  47  */
  48 struct private_child_sa_t {
  49         /**
  50          * Public interface of child_sa_t.
  51          */
  52         child_sa_t public;
  53
  54         /**
  55          * address of us
  56          */
  57         host_t *my_addr;
  58
  59         /**
  60          * address of remote
  61          */
  62         host_t *other_addr;
  63
  64         /**
  65          * our actually used SPI, 0 if unused
  66          */
  67         uint32_t my_spi;
  68
  69         /**
  70          * others used SPI, 0 if unused
  71          */
  72         uint32_t other_spi;
  73
  74         /**
  75          * our Compression Parameter Index (CPI) used, 0 if unused
  76          */
  77         uint16_t my_cpi;
  78
  79         /**
  80          * others Compression Parameter Index (CPI) used, 0 if unused
  81          */
  82         uint16_t other_cpi;
  83
  84         /**
  85          * Array for local traffic selectors
  86          */
  87         array_t *my_ts;
  88
  89         /**
  90          * Array for remote traffic selectors
  91          */
  92         array_t *other_ts;
  93
  94         /**
  95          * Protocol used to protect this SA, ESP|AH
  96          */
  97         protocol_id_t protocol;
  98
  99         /**
 100          * reqid used for this child_sa
 101          */
 102         uint32_t reqid;
 103
 104         /**
 105          * Did we allocate/confirm and must release the reqid?
 106          */
 107         bool reqid_allocated;
 108
 109         /**
 110          * Is the reqid statically configured
 111          */
 112         bool static_reqid;
 113
 114         /*
 115          * Unique CHILD_SA identifier
 116          */
 117         uint32_t unique_id;
 118
 119         /**
 120          * inbound mark used for this child_sa
 121          */
 122         mark_t mark_in;
 123
 124         /**
 125          * outbound mark used for this child_sa
 126          */
 127         mark_t mark_out;
 128
 129         /**
 130          * absolute time when rekeying is scheduled
 131          */
 132         time_t rekey_time;
 133
 134         /**
 135          * absolute time when the SA expires
 136          */
 137         time_t expire_time;
 138
 139         /**
 140          * absolute time when SA has been installed
 141          */
 142         time_t install_time;
 143
 144         /**
 145          * state of the CHILD_SA
 146          */
 147         child_sa_state_t state;
 148
 149         /**
 150          * TRUE if this CHILD_SA is used to install trap policies
 151          */
 152         bool trap;
 153
 154         /**
 155          * Specifies if UDP encapsulation is enabled (NAT traversal)
 156          */
 157         bool encap;
 158
 159         /**
 160          * Specifies the IPComp transform used (IPCOMP_NONE if disabled)
 161          */
 162         ipcomp_transform_t ipcomp;
 163
 164         /**
 165          * mode this SA uses, tunnel/transport
 166          */
 167         ipsec_mode_t mode;
 168
 169         /**
 170          * Action to enforce if peer closes the CHILD_SA
 171          */
 172         action_t close_action;
 173
 174         /**
 175          * Action to enforce if peer is considered dead
 176          */
 177         action_t dpd_action;
 178
 179         /**
 180          * selected proposal
 181          */
 182         proposal_t *proposal;
 183
 184         /**
 185          * config used to create this child
 186          */
 187         child_cfg_t *config;
 188
 189         /**
 190          * time of last use in seconds (inbound)
 191          */
 192         time_t my_usetime;
 193
 194         /**
 195          * time of last use in seconds (outbound)
 196          */
 197         time_t other_usetime;
 198
 199         /**
 200          * last number of inbound bytes
 201          */
 202         uint64_t my_usebytes;
 203
 204         /**
 205          * last number of outbound bytes
 206          */
 207         uint64_t other_usebytes;
 208
 209         /**
 210          * last number of inbound packets
 211          */
 212         uint64_t my_usepackets;
 213
 214         /**
 215          * last number of outbound bytes
 216          */
 217         uint64_t other_usepackets;
 218 };
 219
 220 /**
 221  * convert an IKEv2 specific protocol identifier to the IP protocol identifier.
 222  */
 223 static inline uint8_t proto_ike2ip(protocol_id_t protocol)
 224 {
 225         switch (protocol)
 226         {
 227                 case PROTO_ESP:
 228                         return IPPROTO_ESP;
 229                 case PROTO_AH:
 230                         return IPPROTO_AH;
 231                 default:
 232                         return protocol;
 233         }
 234 }
 235
 236 METHOD(child_sa_t, get_name, char*,
 237            private_child_sa_t *this)
 238 {
 239         return this->config->get_name(this->config);
 240 }
 241
 242 METHOD(child_sa_t, get_reqid, uint32_t,
 243            private_child_sa_t *this)
 244 {
 245         return this->reqid;
 246 }
 247
 248 METHOD(child_sa_t, get_unique_id, uint32_t,
 249         private_child_sa_t *this)
 250 {
 251         return this->unique_id;
 252 }
 253
 254 METHOD(child_sa_t, get_config, child_cfg_t*,
 255            private_child_sa_t *this)
 256 {
 257         return this->config;
 258 }
 259
 260 METHOD(child_sa_t, set_state, void,
 261            private_child_sa_t *this, child_sa_state_t state)
 262 {
 263         charon->bus->child_state_change(charon->bus, &this->public, state);
 264         this->state = state;
 265 }
 266
 267 METHOD(child_sa_t, get_state, child_sa_state_t,
 268            private_child_sa_t *this)
 269 {
 270         return this->state;
 271 }
 272
 273 METHOD(child_sa_t, get_spi, uint32_t,
 274            private_child_sa_t *this, bool inbound)
 275 {
 276         return inbound ? this->my_spi : this->other_spi;
 277 }
 278
 279 METHOD(child_sa_t, get_cpi, uint16_t,
 280            private_child_sa_t *this, bool inbound)
 281 {
 282         return inbound ? this->my_cpi : this->other_cpi;
 283 }
 284
 285 METHOD(child_sa_t, get_protocol, protocol_id_t,
 286            private_child_sa_t *this)
 287 {
 288         return this->protocol;
 289 }
 290
 291 METHOD(child_sa_t, set_protocol, void,
 292            private_child_sa_t *this, protocol_id_t protocol)
 293 {
 294         this->protocol = protocol;
 295 }
 296
 297 METHOD(child_sa_t, get_mode, ipsec_mode_t,
 298            private_child_sa_t *this)
 299 {
 300         return this->mode;
 301 }
 302
 303 METHOD(child_sa_t, set_mode, void,
 304            private_child_sa_t *this, ipsec_mode_t mode)
 305 {
 306         this->mode = mode;
 307 }
 308
 309 METHOD(child_sa_t, has_encap, bool,
 310            private_child_sa_t *this)
 311 {
 312         return this->encap;
 313 }
 314
 315 METHOD(child_sa_t, get_ipcomp, ipcomp_transform_t,
 316            private_child_sa_t *this)
 317 {
 318         return this->ipcomp;
 319 }
 320
 321 METHOD(child_sa_t, set_ipcomp, void,
 322            private_child_sa_t *this, ipcomp_transform_t ipcomp)
 323 {
 324         this->ipcomp = ipcomp;
 325 }
 326
 327 METHOD(child_sa_t, set_close_action, void,
 328            private_child_sa_t *this, action_t action)
 329 {
 330         this->close_action = action;
 331 }
 332
 333 METHOD(child_sa_t, get_close_action, action_t,
 334            private_child_sa_t *this)
 335 {
 336         return this->close_action;
 337 }
 338
 339 METHOD(child_sa_t, set_dpd_action, void,
 340            private_child_sa_t *this, action_t action)
 341 {
 342         this->dpd_action = action;
 343 }
 344
 345 METHOD(child_sa_t, get_dpd_action, action_t,
 346            private_child_sa_t *this)
 347 {
 348         return this->dpd_action;
 349 }
 350
 351 METHOD(child_sa_t, get_proposal, proposal_t*,
 352            private_child_sa_t *this)
 353 {
 354         return this->proposal;
 355 }
 356
 357 METHOD(child_sa_t, set_proposal, void,
 358            private_child_sa_t *this, proposal_t *proposal)
 359 {
 360         this->proposal = proposal->clone(proposal);
 361 }
 362
 363 METHOD(child_sa_t, create_ts_enumerator, enumerator_t*,
 364         private_child_sa_t *this, bool local)
 365 {
 366         if (local)
 367         {
 368                 return array_create_enumerator(this->my_ts);
 369         }
 370         return array_create_enumerator(this->other_ts);
 371 }
 372
 373 typedef struct policy_enumerator_t policy_enumerator_t;
 374
 375 /**
 376  * Private policy enumerator
 377  */
 378 struct policy_enumerator_t {
 379         /** implements enumerator_t */
 380         enumerator_t public;
 381         /** enumerator over own TS */
 382         enumerator_t *mine;
 383         /** enumerator over others TS */
 384         enumerator_t *other;
 385         /** array of others TS, to recreate enumerator */
 386         array_t *array;
 387         /** currently enumerating TS for "me" side */
 388         traffic_selector_t *ts;
 389 };
 390
 391 METHOD(enumerator_t, policy_enumerate, bool,
 392            policy_enumerator_t *this, traffic_selector_t **my_out,
 393            traffic_selector_t **other_out)
 394 {
 395         traffic_selector_t *other_ts;
 396
 397         while (this->ts || this->mine->enumerate(this->mine, &this->ts))
 398         {
 399                 if (!this->other->enumerate(this->other, &other_ts))
 400                 {       /* end of others list, restart with new of mine */
 401                         this->other->destroy(this->other);
 402                         this->other = array_create_enumerator(this->array);
 403                         this->ts = NULL;
 404                         continue;
 405                 }
 406                 if (this->ts->get_type(this->ts) != other_ts->get_type(other_ts))
 407                 {       /* family mismatch */
 408                         continue;
 409                 }
 410                 if (this->ts->get_protocol(this->ts) &&
 411                         other_ts->get_protocol(other_ts) &&
 412                         this->ts->get_protocol(this->ts) != other_ts->get_protocol(other_ts))
 413                 {       /* protocol mismatch */
 414                         continue;
 415                 }
 416                 if (my_out)
 417                 {
 418                         *my_out = this->ts;
 419                 }
 420                 if (other_out)
 421                 {
 422                         *other_out = other_ts;
 423                 }
 424                 return TRUE;
 425         }
 426         return FALSE;
 427 }
 428
 429 METHOD(enumerator_t, policy_destroy, void,
 430            policy_enumerator_t *this)
 431 {
 432         this->mine->destroy(this->mine);
 433         this->other->destroy(this->other);
 434         free(this);
 435 }
 436
 437 METHOD(child_sa_t, create_policy_enumerator, enumerator_t*,
 438            private_child_sa_t *this)
 439 {
 440         policy_enumerator_t *e;
 441
 442         INIT(e,
 443                 .public = {
 444                         .enumerate = (void*)_policy_enumerate,
 445                         .destroy = _policy_destroy,
 446                 },
 447                 .mine = array_create_enumerator(this->my_ts),
 448                 .other = array_create_enumerator(this->other_ts),
 449                 .array = this->other_ts,
 450                 .ts = NULL,
 451         );
 452
 453         return &e->public;
 454 }
 455
 456 /**
 457  * update the cached usebytes
 458  * returns SUCCESS if the usebytes have changed, FAILED if not or no SPIs
 459  * are available, and NOT_SUPPORTED if the kernel interface does not support
 460  * querying the usebytes.
 461  */
 462 static status_t update_usebytes(private_child_sa_t *this, bool inbound)
 463 {
 464         status_t status = FAILED;
 465         uint64_t bytes, packets;
 466         time_t time;
 467
 468         if (inbound)
 469         {
 470                 if (this->my_spi)
 471                 {
 472                         kernel_ipsec_sa_id_t id = {
 473                                 .src = this->other_addr,
 474                                 .dst = this->my_addr,
 475                                 .spi = this->my_spi,
 476                                 .proto = proto_ike2ip(this->protocol),
 477                                 .mark = this->mark_in,
 478                         };
 479                         kernel_ipsec_query_sa_t query = {};
 480
 481                         status = charon->kernel->query_sa(charon->kernel, &id, &query,
 482                                                                                           &bytes, &packets, &time);
 483                         if (status == SUCCESS)
 484                         {
 485                                 if (bytes > this->my_usebytes)
 486                                 {
 487                                         this->my_usebytes = bytes;
 488                                         this->my_usepackets = packets;
 489                                         if (time)
 490                                         {
 491                                                 this->my_usetime = time;
 492                                         }
 493                                         return SUCCESS;
 494                                 }
 495                                 return FAILED;
 496                         }
 497                 }
 498         }
 499         else
 500         {
 501                 if (this->other_spi)
 502                 {
 503                         kernel_ipsec_sa_id_t id = {
 504                                 .src = this->my_addr,
 505                                 .dst = this->other_addr,
 506                                 .spi = this->other_spi,
 507                                 .proto = proto_ike2ip(this->protocol),
 508                                 .mark = this->mark_out,
 509                         };
 510                         kernel_ipsec_query_sa_t query = {};
 511
 512                         status = charon->kernel->query_sa(charon->kernel, &id, &query,
 513                                                                                           &bytes, &packets, &time);
 514                         if (status == SUCCESS)
 515                         {
 516                                 if (bytes > this->other_usebytes)
 517                                 {
 518                                         this->other_usebytes = bytes;
 519                                         this->other_usepackets = packets;
 520                                         if (time)
 521                                         {
 522                                                 this->other_usetime = time;
 523                                         }
 524                                         return SUCCESS;
 525                                 }
 526                                 return FAILED;
 527                         }
 528                 }
 529         }
 530         return status;
 531 }
 532
 533 /**
 534  * updates the cached usetime
 535  */
 536 static bool update_usetime(private_child_sa_t *this, bool inbound)
 537 {
 538         enumerator_t *enumerator;
 539         traffic_selector_t *my_ts, *other_ts;
 540         time_t last_use = 0;
 541
 542         enumerator = create_policy_enumerator(this);
 543         while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
 544         {
 545                 time_t in, out, fwd;
 546
 547                 if (inbound)
 548                 {
 549                         kernel_ipsec_policy_id_t id = {
 550                                 .dir = POLICY_IN,
 551                                 .src_ts = other_ts,
 552                                 .dst_ts = my_ts,
 553                                 .mark = this->mark_in,
 554                         };
 555                         kernel_ipsec_query_policy_t query = {};
 556
 557                         if (charon->kernel->query_policy(charon->kernel, &id, &query,
 558                                                                                          &in) == SUCCESS)
 559                         {
 560                                 last_use = max(last_use, in);
 561                         }
 562                         if (this->mode != MODE_TRANSPORT)
 563                         {
 564                                 id.dir = POLICY_FWD;
 565                                 if (charon->kernel->query_policy(charon->kernel, &id, &query,
 566                                                                                                  &fwd) == SUCCESS)
 567                                 {
 568                                         last_use = max(last_use, fwd);
 569                                 }
 570                         }
 571                 }
 572                 else
 573                 {
 574                         kernel_ipsec_policy_id_t id = {
 575                                 .dir = POLICY_OUT,
 576                                 .src_ts = my_ts,
 577                                 .dst_ts = other_ts,
 578                                 .mark = this->mark_out,
 579                         };
 580                         kernel_ipsec_query_policy_t query = {};
 581
 582                         if (charon->kernel->query_policy(charon->kernel, &id, &query,
 583                                                                                          &out) == SUCCESS)
 584                         {
 585                                 last_use = max(last_use, out);
 586                         }
 587                 }
 588         }
 589         enumerator->destroy(enumerator);
 590
 591         if (last_use == 0)
 592         {
 593                 return FALSE;
 594         }
 595         if (inbound)
 596         {
 597                 this->my_usetime = last_use;
 598         }
 599         else
 600         {
 601                 this->other_usetime = last_use;
 602         }
 603         return TRUE;
 604 }
 605
 606 METHOD(child_sa_t, get_usestats, void,
 607         private_child_sa_t *this, bool inbound,
 608         time_t *time, uint64_t *bytes, uint64_t *packets)
 609 {
 610         if ((!bytes && !packets) || update_usebytes(this, inbound) != FAILED)
 611         {
 612                 /* there was traffic since last update or the kernel interface
 613                  * does not support querying the number of usebytes.
 614                  */
 615                 if (time)
 616                 {
 617                         if (!update_usetime(this, inbound) && !bytes && !packets)
 618                         {
 619                                 /* if policy query did not yield a usetime, query SAs instead */
 620                                 update_usebytes(this, inbound);
 621                         }
 622                 }
 623         }
 624         if (time)
 625         {
 626                 *time = inbound ? this->my_usetime : this->other_usetime;
 627         }
 628         if (bytes)
 629         {
 630                 *bytes = inbound ? this->my_usebytes : this->other_usebytes;
 631         }
 632         if (packets)
 633         {
 634                 *packets = inbound ? this->my_usepackets : this->other_usepackets;
 635         }
 636 }
 637
 638 METHOD(child_sa_t, get_mark, mark_t,
 639         private_child_sa_t *this, bool inbound)
 640 {
 641         if (inbound)
 642         {
 643                 return this->mark_in;
 644         }
 645         return this->mark_out;
 646 }
 647
 648 METHOD(child_sa_t, get_lifetime, time_t,
 649            private_child_sa_t *this, bool hard)
 650 {
 651         return hard ? this->expire_time : this->rekey_time;
 652 }
 653
 654 METHOD(child_sa_t, get_installtime, time_t,
 655         private_child_sa_t *this)
 656 {
 657         return this->install_time;
 658 }
 659
 660 METHOD(child_sa_t, alloc_spi, uint32_t,
 661            private_child_sa_t *this, protocol_id_t protocol)
 662 {
 663         if (charon->kernel->get_spi(charon->kernel, this->other_addr, this->my_addr,
 664                                                         proto_ike2ip(protocol), &this->my_spi) == SUCCESS)
 665         {
 666                 /* if we allocate a SPI, but then are unable to establish the SA, we
 667                  * need to know the protocol family to delete the partial SA */
 668                 this->protocol = protocol;
 669                 return this->my_spi;
 670         }
 671         return 0;
 672 }
 673
 674 METHOD(child_sa_t, alloc_cpi, uint16_t,
 675            private_child_sa_t *this)
 676 {
 677         if (charon->kernel->get_cpi(charon->kernel, this->other_addr, this->my_addr,
 678                                                                 &this->my_cpi) == SUCCESS)
 679         {
 680                 return this->my_cpi;
 681         }
 682         return 0;
 683 }
 684
 685 METHOD(child_sa_t, install, status_t,
 686         private_child_sa_t *this, chunk_t encr, chunk_t integ, uint32_t spi,
 687         uint16_t cpi, bool initiator, bool inbound, bool tfcv3,
 688         linked_list_t *my_ts, linked_list_t *other_ts)
 689 {
 690         uint16_t enc_alg = ENCR_UNDEFINED, int_alg = AUTH_UNDEFINED, size;
 691         uint16_t esn = NO_EXT_SEQ_NUMBERS;
 692         linked_list_t *src_ts = NULL, *dst_ts = NULL;
 693         time_t now;
 694         kernel_ipsec_sa_id_t id;
 695         kernel_ipsec_add_sa_t sa;
 696         lifetime_cfg_t *lifetime;
 697         uint32_t tfc = 0;
 698         host_t *src, *dst;
 699         status_t status;
 700         bool update = FALSE;
 701
 702         /* now we have to decide which spi to use. Use self allocated, if "in",
 703          * or the one in the proposal, if not "in" (others). Additionally,
 704          * source and dest host switch depending on the role */
 705         if (inbound)
 706         {
 707                 dst = this->my_addr;
 708                 src = this->other_addr;
 709                 if (this->my_spi == spi)
 710                 {       /* alloc_spi has been called, do an SA update */
 711                         update = TRUE;
 712                 }
 713                 this->my_spi = spi;
 714                 this->my_cpi = cpi;
 715         }
 716         else
 717         {
 718                 src = this->my_addr;
 719                 dst = this->other_addr;
 720                 this->other_spi = spi;
 721                 this->other_cpi = cpi;
 722
 723                 if (tfcv3)
 724                 {
 725                         tfc = this->config->get_tfc(this->config);
 726                 }
 727         }
 728
 729         DBG2(DBG_CHD, "adding %s %N SA", inbound ? "inbound" : "outbound",
 730                  protocol_id_names, this->protocol);
 731
 732         /* send SA down to the kernel */
 733         DBG2(DBG_CHD, "  SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
 734
 735         this->proposal->get_algorithm(this->proposal, ENCRYPTION_ALGORITHM,
 736                                                                   &enc_alg, &size);
 737         this->proposal->get_algorithm(this->proposal, INTEGRITY_ALGORITHM,
 738                                                                   &int_alg, &size);
 739         this->proposal->get_algorithm(this->proposal, EXTENDED_SEQUENCE_NUMBERS,
 740                                                                   &esn, NULL);
 741
 742         if (!this->reqid_allocated && !this->static_reqid)
 743         {
 744                 status = charon->kernel->alloc_reqid(charon->kernel, my_ts, other_ts,
 745                                                                 this->mark_in, this->mark_out, &this->reqid);
 746                 if (status != SUCCESS)
 747                 {
 748                         return status;
 749                 }
 750                 this->reqid_allocated = TRUE;
 751         }
 752
 753         lifetime = this->config->get_lifetime(this->config);
 754
 755         now = time_monotonic(NULL);
 756         if (lifetime->time.rekey)
 757         {
 758                 if (this->rekey_time)
 759                 {
 760                         this->rekey_time = min(this->rekey_time, now + lifetime->time.rekey);
 761                 }
 762                 else
 763                 {
 764                         this->rekey_time = now + lifetime->time.rekey;
 765                 }
 766         }
 767         if (lifetime->time.life)
 768         {
 769                 this->expire_time = now + lifetime->time.life;
 770         }
 771
 772         if (!lifetime->time.jitter && !inbound)
 773         {       /* avoid triggering multiple rekey events */
 774                 lifetime->time.rekey = 0;
 775         }
 776
 777         /* BEET requires the bound address from the traffic selectors */
 778         if (inbound)
 779         {
 780                 dst_ts = my_ts;
 781                 src_ts = other_ts;
 782         }
 783         else
 784         {
 785                 src_ts = my_ts;
 786                 dst_ts = other_ts;
 787         }
 788
 789         id = (kernel_ipsec_sa_id_t){
 790                 .src = src,
 791                 .dst = dst,
 792                 .spi = spi,
 793                 .proto = proto_ike2ip(this->protocol),
 794                 .mark = inbound ? this->mark_in : this->mark_out,
 795         };
 796         sa = (kernel_ipsec_add_sa_t){
 797                 .reqid = this->reqid,
 798                 .mode = this->mode,
 799                 .src_ts = src_ts,
 800                 .dst_ts = dst_ts,
 801                 .lifetime = lifetime,
 802                 .enc_alg = enc_alg,
 803                 .enc_key = encr,
 804                 .int_alg = int_alg,
 805                 .int_key = integ,
 806                 .replay_window = this->config->get_replay_window(this->config),
 807                 .tfc = tfc,
 808                 .ipcomp = this->ipcomp,
 809                 .cpi = cpi,
 810                 .encap = this->encap,
 811                 .esn = esn,
 812                 .initiator = initiator,
 813                 .inbound = inbound,
 814                 .update = update,
 815         };
 816
 817         status = charon->kernel->add_sa(charon->kernel, &id, &sa);
 818
 819         free(lifetime);
 820
 821         return status;
 822 }
 823
 824 /**
 825  * Check kernel interface if policy updates are required
 826  */
 827 static bool require_policy_update()
 828 {
 829         kernel_feature_t f;
 830
 831         f = charon->kernel->get_features(charon->kernel);
 832         return !(f & KERNEL_NO_POLICY_UPDATES);
 833 }
 834
 835 /**
 836  * Prepare SA config to install/delete policies
 837  */
 838 static void prepare_sa_cfg(private_child_sa_t *this, ipsec_sa_cfg_t *my_sa,
 839                                                    ipsec_sa_cfg_t *other_sa)
 840 {
 841         enumerator_t *enumerator;
 842
 843         *my_sa = (ipsec_sa_cfg_t){
 844                 .mode = this->mode,
 845                 .reqid = this->reqid,
 846                 .ipcomp = {
 847                         .transform = this->ipcomp,
 848                 },
 849         };
 850         *other_sa = *my_sa;
 851
 852         my_sa->ipcomp.cpi = this->my_cpi;
 853         other_sa->ipcomp.cpi = this->other_cpi;
 854
 855         if (this->protocol == PROTO_ESP)
 856         {
 857                 my_sa->esp.use = TRUE;
 858                 my_sa->esp.spi = this->my_spi;
 859                 other_sa->esp.use = TRUE;
 860                 other_sa->esp.spi = this->other_spi;
 861         }
 862         else
 863         {
 864                 my_sa->ah.use = TRUE;
 865                 my_sa->ah.spi = this->my_spi;
 866                 other_sa->ah.use = TRUE;
 867                 other_sa->ah.spi = this->other_spi;
 868         }
 869
 870         enumerator = create_policy_enumerator(this);
 871         while (enumerator->enumerate(enumerator, NULL, NULL))
 872         {
 873                 my_sa->policy_count++;
 874                 other_sa->policy_count++;
 875         }
 876         enumerator->destroy(enumerator);
 877 }
 878
 879 /**
 880  * Install 3 policies: out, in and forward
 881  */
 882 static status_t install_policies_internal(private_child_sa_t *this,
 883         host_t *my_addr, host_t *other_addr, traffic_selector_t *my_ts,
 884         traffic_selector_t *other_ts, ipsec_sa_cfg_t *my_sa,
 885         ipsec_sa_cfg_t *other_sa, policy_type_t type,
 886         policy_priority_t priority,     uint32_t manual_prio)
 887 {
 888         kernel_ipsec_policy_id_t out_id = {
 889                 .dir = POLICY_OUT,
 890                 .src_ts = my_ts,
 891                 .dst_ts = other_ts,
 892                 .mark = this->mark_out,
 893         }, in_id = {
 894                 .dir = POLICY_IN,
 895                 .src_ts = other_ts,
 896                 .dst_ts = my_ts,
 897                 .mark = this->mark_in,
 898         };
 899         kernel_ipsec_manage_policy_t out_policy = {
 900                 .type = type,
 901                 .prio = priority,
 902                 .manual_prio = manual_prio,
 903                 .src = my_addr,
 904                 .dst = other_addr,
 905                 .sa = other_sa,
 906         }, in_policy = {
 907                 .type = type,
 908                 .prio = priority,
 909                 .manual_prio = manual_prio,
 910                 .src = other_addr,
 911                 .dst = my_addr,
 912                 .sa = my_sa,
 913         };
 914         status_t status = SUCCESS;
 915
 916         status |= charon->kernel->add_policy(charon->kernel, &out_id, &out_policy);
 917         status |= charon->kernel->add_policy(charon->kernel, &in_id, &in_policy);
 918         if (this->mode != MODE_TRANSPORT)
 919         {
 920                 in_id.dir = POLICY_FWD;
 921                 status |= charon->kernel->add_policy(charon->kernel, &in_id, &in_policy);
 922
 923                 /* install an "outbound" FWD policy in case there is a drop policy
 924                  * matching outbound forwarded traffic, to allow another tunnel to use
 925                  * the reversed subnets and do the same we don't set a reqid (this also
 926                  * allows the kernel backend to distinguish between the two types of
 927                  * FWD policies) */
 928                 out_id.dir = POLICY_FWD;
 929                 other_sa->reqid = 0;
 930                 status |= charon->kernel->add_policy(charon->kernel, &out_id, &out_policy);
 931                 /* reset the reqid for any other further policies */
 932                 other_sa->reqid = this->reqid;
 933         }
 934         return status;
 935 }
 936
 937 /**
 938  * Delete 3 policies: out, in and forward
 939  */
 940 static void del_policies_internal(private_child_sa_t *this,
 941         host_t *my_addr, host_t *other_addr, traffic_selector_t *my_ts,
 942         traffic_selector_t *other_ts, ipsec_sa_cfg_t *my_sa,
 943         ipsec_sa_cfg_t *other_sa, policy_type_t type,
 944         policy_priority_t priority, uint32_t manual_prio)
 945 {
 946         kernel_ipsec_policy_id_t out_id = {
 947                 .dir = POLICY_OUT,
 948                 .src_ts = my_ts,
 949                 .dst_ts = other_ts,
 950                 .mark = this->mark_out,
 951         }, in_id = {
 952                 .dir = POLICY_IN,
 953                 .src_ts = other_ts,
 954                 .dst_ts = my_ts,
 955                 .mark = this->mark_in,
 956         };
 957         kernel_ipsec_manage_policy_t out_policy = {
 958                 .type = type,
 959                 .prio = priority,
 960                 .manual_prio = manual_prio,
 961                 .src = my_addr,
 962                 .dst = other_addr,
 963                 .sa = other_sa,
 964         }, in_policy = {
 965                 .type = type,
 966                 .prio = priority,
 967                 .manual_prio = manual_prio,
 968                 .src = other_addr,
 969                 .dst = my_addr,
 970                 .sa = my_sa,
 971         };
 972
 973         charon->kernel->del_policy(charon->kernel, &out_id, &out_policy);
 974         charon->kernel->del_policy(charon->kernel, &in_id, &in_policy);
 975         if (this->mode != MODE_TRANSPORT)
 976         {
 977                 in_id.dir = POLICY_FWD;
 978                 charon->kernel->del_policy(charon->kernel, &in_id, &in_policy);
 979
 980                 out_id.dir = POLICY_FWD;
 981                 other_sa->reqid = 0;
 982                 charon->kernel->del_policy(charon->kernel, &out_id, &out_policy);
 983                 other_sa->reqid = this->reqid;
 984         }
 985 }
 986
 987 METHOD(child_sa_t, add_policies, status_t,
 988            private_child_sa_t *this, linked_list_t *my_ts_list,
 989            linked_list_t *other_ts_list)
 990 {
 991         enumerator_t *enumerator;
 992         traffic_selector_t *my_ts, *other_ts;
 993         status_t status = SUCCESS;
 994
 995         if (!this->reqid_allocated && !this->static_reqid)
 996         {
 997                 /* trap policy, get or confirm reqid */
 998                 status = charon->kernel->alloc_reqid(
 999                                                         charon->kernel, my_ts_list, other_ts_list,
1000                                                         this->mark_in, this->mark_out, &this->reqid);
1001                 if (status != SUCCESS)
1002                 {
1003                         return status;
1004                 }
1005                 this->reqid_allocated = TRUE;
1006         }
1007
1008         /* apply traffic selectors */
1009         enumerator = my_ts_list->create_enumerator(my_ts_list);
1010         while (enumerator->enumerate(enumerator, &my_ts))
1011         {
1012                 array_insert(this->my_ts, ARRAY_TAIL, my_ts->clone(my_ts));
1013         }
1014         enumerator->destroy(enumerator);
1015         array_sort(this->my_ts, (void*)traffic_selector_cmp, NULL);
1016
1017         enumerator = other_ts_list->create_enumerator(other_ts_list);
1018         while (enumerator->enumerate(enumerator, &other_ts))
1019         {
1020                 array_insert(this->other_ts, ARRAY_TAIL, other_ts->clone(other_ts));
1021         }
1022         enumerator->destroy(enumerator);
1023         array_sort(this->other_ts, (void*)traffic_selector_cmp, NULL);
1024
1025         if (this->config->install_policy(this->config))
1026         {
1027                 policy_priority_t priority;
1028                 ipsec_sa_cfg_t my_sa, other_sa;
1029                 uint32_t manual_prio;
1030
1031                 prepare_sa_cfg(this, &my_sa, &other_sa);
1032                 manual_prio = this->config->get_manual_prio(this->config);
1033
1034                 /* if we're not in state CHILD_INSTALLING (i.e. if there is no SAD
1035                  * entry) we install a trap policy */
1036                 this->trap = this->state == CHILD_CREATED;
1037                 priority = this->trap ? POLICY_PRIORITY_ROUTED
1038                                                           : POLICY_PRIORITY_DEFAULT;
1039
1040                 /* enumerate pairs of traffic selectors */
1041                 enumerator = create_policy_enumerator(this);
1042                 while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
1043                 {
1044                         /* install outbound drop policy to avoid packets leaving unencrypted
1045                          * when updating policies */
1046                         if (priority == POLICY_PRIORITY_DEFAULT && manual_prio == 0 &&
1047                                 require_policy_update())
1048                         {
1049                                 status |= install_policies_internal(this, this->my_addr,
1050                                                                         this->other_addr, my_ts, other_ts,
1051                                                                         &my_sa, &other_sa, POLICY_DROP,
1052                                                                         POLICY_PRIORITY_FALLBACK, 0);
1053                         }
1054
1055                         /* install policies */
1056                         status |= install_policies_internal(this, this->my_addr,
1057                                                                         this->other_addr, my_ts, other_ts,
1058                                                                         &my_sa, &other_sa, POLICY_IPSEC,
1059                                                                         priority, manual_prio);
1060
1061                         if (status != SUCCESS)
1062                         {
1063                                 break;
1064                         }
1065                 }
1066                 enumerator->destroy(enumerator);
1067         }
1068
1069         if (status == SUCCESS && this->trap)
1070         {
1071                 set_state(this, CHILD_ROUTED);
1072         }
1073         return status;
1074 }
1075
1076 /**
1077  * Callback to reinstall a virtual IP
1078  */
1079 static void reinstall_vip(host_t *vip, host_t *me)
1080 {
1081         char *iface;
1082
1083         if (charon->kernel->get_interface(charon->kernel, me, &iface))
1084         {
1085                 charon->kernel->del_ip(charon->kernel, vip, -1, TRUE);
1086                 charon->kernel->add_ip(charon->kernel, vip, -1, iface);
1087                 free(iface);
1088         }
1089 }
1090
1091 METHOD(child_sa_t, update, status_t,
1092         private_child_sa_t *this,  host_t *me, host_t *other, linked_list_t *vips,
1093         bool encap)
1094 {
1095         child_sa_state_t old;
1096         bool transport_proxy_mode;
1097
1098         /* anything changed at all? */
1099         if (me->equals(me, this->my_addr) &&
1100                 other->equals(other, this->other_addr) && this->encap == encap)
1101         {
1102                 return SUCCESS;
1103         }
1104
1105         old = this->state;
1106         set_state(this, CHILD_UPDATING);
1107         transport_proxy_mode = this->config->use_proxy_mode(this->config) &&
1108                                                    this->mode == MODE_TRANSPORT;
1109
1110         if (!transport_proxy_mode)
1111         {
1112                 /* update our (initiator) SA */
1113                 if (this->my_spi)
1114                 {
1115                         kernel_ipsec_sa_id_t id = {
1116                                 .src = this->other_addr,
1117                                 .dst = this->my_addr,
1118                                 .spi = this->my_spi,
1119                                 .proto = proto_ike2ip(this->protocol),
1120                                 .mark = this->mark_in,
1121                         };
1122                         kernel_ipsec_update_sa_t sa = {
1123                                 .cpi = this->ipcomp != IPCOMP_NONE ? this->my_cpi : 0,
1124                                 .new_src = other,
1125                                 .new_dst = me,
1126                                 .encap = this->encap,
1127                                 .new_encap = encap,
1128                         };
1129                         if (charon->kernel->update_sa(charon->kernel, &id,
1130                                                                                   &sa) == NOT_SUPPORTED)
1131                         {
1132                                 set_state(this, old);
1133                                 return NOT_SUPPORTED;
1134                         }
1135                 }
1136
1137                 /* update his (responder) SA */
1138                 if (this->other_spi)
1139                 {
1140                         kernel_ipsec_sa_id_t id = {
1141                                 .src = this->my_addr,
1142                                 .dst = this->other_addr,
1143                                 .spi = this->other_spi,
1144                                 .proto = proto_ike2ip(this->protocol),
1145                                 .mark = this->mark_out,
1146                         };
1147                         kernel_ipsec_update_sa_t sa = {
1148                                 .cpi = this->ipcomp != IPCOMP_NONE ? this->other_cpi : 0,
1149                                 .new_src = me,
1150                                 .new_dst = other,
1151                                 .encap = this->encap,
1152                                 .new_encap = encap,
1153                         };
1154                         if (charon->kernel->update_sa(charon->kernel, &id,
1155                                                                                   &sa) == NOT_SUPPORTED)
1156                         {
1157                                 set_state(this, old);
1158                                 return NOT_SUPPORTED;
1159                         }
1160                 }
1161         }
1162
1163         if (this->config->install_policy(this->config) && require_policy_update())
1164         {
1165                 if (!me->ip_equals(me, this->my_addr) ||
1166                         !other->ip_equals(other, this->other_addr))
1167                 {
1168                         ipsec_sa_cfg_t my_sa, other_sa;
1169                         enumerator_t *enumerator;
1170                         traffic_selector_t *my_ts, *other_ts;
1171                         uint32_t manual_prio;
1172
1173                         prepare_sa_cfg(this, &my_sa, &other_sa);
1174                         manual_prio = this->config->get_manual_prio(this->config);
1175
1176                         /* always use high priorities, as hosts getting updated are INSTALLED */
1177                         enumerator = create_policy_enumerator(this);
1178                         while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
1179                         {
1180                                 traffic_selector_t *old_my_ts = NULL, *old_other_ts = NULL;
1181
1182                                 /* remove old policies first */
1183                                 del_policies_internal(this, this->my_addr, this->other_addr,
1184                                                         my_ts, other_ts, &my_sa, &other_sa, POLICY_IPSEC,
1185                                                         POLICY_PRIORITY_DEFAULT, manual_prio);
1186
1187                                 /* check if we have to update a "dynamic" traffic selector */
1188                                 if (!me->ip_equals(me, this->my_addr) &&
1189                                         my_ts->is_host(my_ts, this->my_addr))
1190                                 {
1191                                         old_my_ts = my_ts->clone(my_ts);
1192                                         my_ts->set_address(my_ts, me);
1193                                 }
1194                                 if (!other->ip_equals(other, this->other_addr) &&
1195                                         other_ts->is_host(other_ts, this->other_addr))
1196                                 {
1197                                         old_other_ts = other_ts->clone(other_ts);
1198                                         other_ts->set_address(other_ts, other);
1199                                 }
1200
1201                                 /* we reinstall the virtual IP to handle interface roaming
1202                                  * correctly */
1203                                 vips->invoke_function(vips, (void*)reinstall_vip, me);
1204
1205                                 /* reinstall updated policies */
1206                                 install_policies_internal(this, me, other, my_ts, other_ts,
1207                                                                                   &my_sa, &other_sa, POLICY_IPSEC,
1208                                                                                   POLICY_PRIORITY_DEFAULT, manual_prio);
1209
1210                                 /* update fallback policies after the new policy is in place */
1211                                 if (manual_prio == 0)
1212                                 {
1213                                         del_policies_internal(this, this->my_addr, this->other_addr,
1214                                                                                   old_my_ts ?: my_ts,
1215                                                                                   old_other_ts ?: other_ts,
1216                                                                                   &my_sa, &other_sa, POLICY_DROP,
1217                                                                                   POLICY_PRIORITY_FALLBACK, 0);
1218                                         install_policies_internal(this, me, other, my_ts, other_ts,
1219                                                                                   &my_sa, &other_sa, POLICY_DROP,
1220                                                                                   POLICY_PRIORITY_FALLBACK, 0);
1221                                 }
1222                                 DESTROY_IF(old_my_ts);
1223                                 DESTROY_IF(old_other_ts);
1224                         }
1225                         enumerator->destroy(enumerator);
1226                 }
1227         }
1228
1229         if (!transport_proxy_mode)
1230         {
1231                 /* apply hosts */
1232                 if (!me->equals(me, this->my_addr))
1233                 {
1234                         this->my_addr->destroy(this->my_addr);
1235                         this->my_addr = me->clone(me);
1236                 }
1237                 if (!other->equals(other, this->other_addr))
1238                 {
1239                         this->other_addr->destroy(this->other_addr);
1240                         this->other_addr = other->clone(other);
1241                 }
1242         }
1243
1244         this->encap = encap;
1245         set_state(this, old);
1246
1247         return SUCCESS;
1248 }
1249
1250 METHOD(child_sa_t, destroy, void,
1251            private_child_sa_t *this)
1252 {
1253         enumerator_t *enumerator;
1254         traffic_selector_t *my_ts, *other_ts;
1255         policy_priority_t priority;
1256
1257         priority = this->trap ? POLICY_PRIORITY_ROUTED : POLICY_PRIORITY_DEFAULT;
1258
1259         set_state(this, CHILD_DESTROYING);
1260
1261         if (this->config->install_policy(this->config))
1262         {
1263                 ipsec_sa_cfg_t my_sa, other_sa;
1264                 uint32_t manual_prio;
1265
1266                 prepare_sa_cfg(this, &my_sa, &other_sa);
1267                 manual_prio = this->config->get_manual_prio(this->config);
1268
1269                 /* delete all policies in the kernel */
1270                 enumerator = create_policy_enumerator(this);
1271                 while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
1272                 {
1273                         del_policies_internal(this, this->my_addr, this->other_addr,
1274                                                                   my_ts, other_ts, &my_sa, &other_sa,
1275                                                                   POLICY_IPSEC, priority, manual_prio);
1276                         if (priority == POLICY_PRIORITY_DEFAULT && manual_prio == 0 &&
1277                                 require_policy_update())
1278                         {
1279                                 del_policies_internal(this, this->my_addr, this->other_addr,
1280                                                                           my_ts, other_ts, &my_sa, &other_sa,
1281                                                                           POLICY_DROP, POLICY_PRIORITY_FALLBACK, 0);
1282                         }
1283                 }
1284                 enumerator->destroy(enumerator);
1285         }
1286
1287         /* delete SAs in the kernel, if they are set up */
1288         if (this->my_spi)
1289         {
1290                 kernel_ipsec_sa_id_t id = {
1291                         .src = this->other_addr,
1292                         .dst = this->my_addr,
1293                         .spi = this->my_spi,
1294                         .proto = proto_ike2ip(this->protocol),
1295                         .mark = this->mark_in,
1296                 };
1297                 kernel_ipsec_del_sa_t sa = {
1298                         .cpi = this->my_cpi,
1299                 };
1300                 charon->kernel->del_sa(charon->kernel, &id, &sa);
1301         }
1302         if (this->other_spi)
1303         {
1304                 kernel_ipsec_sa_id_t id = {
1305                         .src = this->my_addr,
1306                         .dst = this->other_addr,
1307                         .spi = this->other_spi,
1308                         .proto = proto_ike2ip(this->protocol),
1309                         .mark = this->mark_out,
1310                 };
1311                 kernel_ipsec_del_sa_t sa = {
1312                         .cpi = this->other_cpi,
1313                 };
1314                 charon->kernel->del_sa(charon->kernel, &id, &sa);
1315         }
1316
1317         if (this->reqid_allocated)
1318         {
1319                 if (charon->kernel->release_reqid(charon->kernel,
1320                                                 this->reqid, this->mark_in, this->mark_out) != SUCCESS)
1321                 {
1322                         DBG1(DBG_CHD, "releasing reqid %u failed", this->reqid);
1323                 }
1324         }
1325
1326         array_destroy_offset(this->my_ts, offsetof(traffic_selector_t, destroy));
1327         array_destroy_offset(this->other_ts, offsetof(traffic_selector_t, destroy));
1328         this->my_addr->destroy(this->my_addr);
1329         this->other_addr->destroy(this->other_addr);
1330         DESTROY_IF(this->proposal);
1331         this->config->destroy(this->config);
1332         free(this);
1333 }
1334
1335 /**
1336  * Get proxy address for one side, if any
1337  */
1338 static host_t* get_proxy_addr(child_cfg_t *config, host_t *ike, bool local)
1339 {
1340         host_t *host = NULL;
1341         uint8_t mask;
1342         enumerator_t *enumerator;
1343         linked_list_t *ts_list, *list;
1344         traffic_selector_t *ts;
1345
1346         list = linked_list_create_with_items(ike, NULL);
1347         ts_list = config->get_traffic_selectors(config, local, NULL, list);
1348         list->destroy(list);
1349
1350         enumerator = ts_list->create_enumerator(ts_list);
1351         while (enumerator->enumerate(enumerator, &ts))
1352         {
1353                 if (ts->is_host(ts, NULL) && ts->to_subnet(ts, &host, &mask))
1354                 {
1355                         DBG1(DBG_CHD, "%s address: %H is a transport mode proxy for %H",
1356                                  local ? "my" : "other", ike, host);
1357                         break;
1358                 }
1359         }
1360         enumerator->destroy(enumerator);
1361         ts_list->destroy_offset(ts_list, offsetof(traffic_selector_t, destroy));
1362
1363         if (!host)
1364         {
1365                 host = ike->clone(ike);
1366         }
1367         return host;
1368 }
1369
1370 /**
1371  * Described in header.
1372  */
1373 child_sa_t * child_sa_create(host_t *me, host_t* other,
1374                                                          child_cfg_t *config, uint32_t rekey, bool encap,
1375                                                          u_int mark_in, u_int mark_out)
1376 {
1377         private_child_sa_t *this;
1378         static refcount_t unique_id = 0, unique_mark = 0, mark;
1379
1380         INIT(this,
1381                 .public = {
1382                         .get_name = _get_name,
1383                         .get_reqid = _get_reqid,
1384                         .get_unique_id = _get_unique_id,
1385                         .get_config = _get_config,
1386                         .get_state = _get_state,
1387                         .set_state = _set_state,
1388                         .get_spi = _get_spi,
1389                         .get_cpi = _get_cpi,
1390                         .get_protocol = _get_protocol,
1391                         .set_protocol = _set_protocol,
1392                         .get_mode = _get_mode,
1393                         .set_mode = _set_mode,
1394                         .get_proposal = _get_proposal,
1395                         .set_proposal = _set_proposal,
1396                         .get_lifetime = _get_lifetime,
1397                         .get_installtime = _get_installtime,
1398                         .get_usestats = _get_usestats,
1399                         .get_mark = _get_mark,
1400                         .has_encap = _has_encap,
1401                         .get_ipcomp = _get_ipcomp,
1402                         .set_ipcomp = _set_ipcomp,
1403                         .get_close_action = _get_close_action,
1404                         .set_close_action = _set_close_action,
1405                         .get_dpd_action = _get_dpd_action,
1406                         .set_dpd_action = _set_dpd_action,
1407                         .alloc_spi = _alloc_spi,
1408                         .alloc_cpi = _alloc_cpi,
1409                         .install = _install,
1410                         .update = _update,
1411                         .add_policies = _add_policies,
1412                         .create_ts_enumerator = _create_ts_enumerator,
1413                         .create_policy_enumerator = _create_policy_enumerator,
1414                         .destroy = _destroy,
1415                 },
1416                 .encap = encap,
1417                 .ipcomp = IPCOMP_NONE,
1418                 .state = CHILD_CREATED,
1419                 .my_ts = array_create(0, 0),
1420                 .other_ts = array_create(0, 0),
1421                 .protocol = PROTO_NONE,
1422                 .mode = MODE_TUNNEL,
1423                 .close_action = config->get_close_action(config),
1424                 .dpd_action = config->get_dpd_action(config),
1425                 .reqid = config->get_reqid(config),
1426                 .unique_id = ref_get(&unique_id),
1427                 .mark_in = config->get_mark(config, TRUE),
1428                 .mark_out = config->get_mark(config, FALSE),
1429                 .install_time = time_monotonic(NULL),
1430         );
1431
1432         this->config = config;
1433         config->get_ref(config);
1434
1435         if (mark_in)
1436         {
1437                 this->mark_in.value = mark_in;
1438         }
1439         if (mark_out)
1440         {
1441                 this->mark_out.value = mark_out;
1442         }
1443         if (this->mark_in.value == MARK_UNIQUE ||
1444                 this->mark_out.value == MARK_UNIQUE)
1445         {
1446                 mark = ref_get(&unique_mark);
1447                 if (this->mark_in.value == MARK_UNIQUE)
1448                 {
1449                         this->mark_in.value = mark;
1450                 }
1451                 if (this->mark_out.value == MARK_UNIQUE)
1452                 {
1453                         this->mark_out.value = mark;
1454                 }
1455         }
1456
1457         if (!this->reqid)
1458         {
1459                 /* reuse old reqid if we are rekeying an existing CHILD_SA. While the
1460                  * reqid cache would find the same reqid for our selectors, this does
1461                  * not work in a special case: If an SA is triggered by a trap policy,
1462                  * but the negotiated SA gets narrowed, we still must reuse the same
1463                  * reqid to successfully "trigger" the SA on the kernel level. Rekeying
1464                  * such an SA requires an explicit reqid, as the cache currently knows
1465                  * the original selectors only for that reqid. */
1466                 if (rekey)
1467                 {
1468                         this->reqid = rekey;
1469                 }
1470                 else
1471                 {
1472                         this->reqid = charon->traps->find_reqid(charon->traps, config);
1473                 }
1474         }
1475         else
1476         {
1477                 this->static_reqid = TRUE;
1478         }
1479
1480         /* MIPv6 proxy transport mode sets SA endpoints to TS hosts */
1481         if (config->get_mode(config) == MODE_TRANSPORT &&
1482                 config->use_proxy_mode(config))
1483         {
1484                 this->mode = MODE_TRANSPORT;
1485
1486                 this->my_addr = get_proxy_addr(config, me, TRUE);
1487                 this->other_addr = get_proxy_addr(config, other, FALSE);
1488         }
1489         else
1490         {
1491                 this->my_addr = me->clone(me);
1492                 this->other_addr = other->clone(other);
1493         }
1494         return &this->public;
1495 }